Method and system for monitoring and analyzing of IP networks elements

ABSTRACT

Exemplary embodiments include methods and systems for monitoring, analyzing, and troubleshooting of control plane dynamics of a network including collecting state data from the one or more routers of one or more protocols at discrete time intervals, the state data being associated with one or more routers of a network, analyzing corresponding state data collected at two or more discrete time intervals, and outputting a result of the analysis of the state data collected from the one or more routers of the network.

BACKGROUND

Monitoring and/or troubleshooting network elements are a growing concernfor Internet Service Providers (ISPs) as the Internet and use of theInternet continues to grow. Routing of data may be controlled by routingprotocols. Open Shortest Path First (OSPF) is a hierarchical interiorgateway protocol (IOP) for routing in Internet Protocol, using alink-state in the individual areas that make up the hierarchy. LabelDistribution Protocol (LDP) is a protocol in which two label switchrouters (LSR) exchange label mapping information (e.g., trafficinformation for multiprotocol label switching (MPLS) network).Protocol-Independent Multicast (PIM) is a family of multicast routingprotocols that can provide one-to-many distribution of data over theInternet. Internal Border Independent Protocol (iBGP) is the corerouting protocol of the Internet and works by maintaining a table of IPnetworks or prefixes which designate network reachability amongautonomous network systems. Reducing downtime or avoiding problemsassociated with routing and/or network elements are an increasingconcern to the Internet Service Providers (ISPs). Conventionaltroubleshooting of network elements typically requires a user tomanually access each network element to collect information associatedwith the network element, thus this process may be tedious and timeconsuming. Also, conventional troubleshooting of network elements mayrequire a manual analysis of the collected information in order toidentify one or more problems associated with the network elements.Another conventional troubleshooting of network elements may rely on thenetwork elements to alert a network manager of one or more problems.Often times the network manager may miss an alert.

BRIEF DESCRIPTION OF THE DRAWINGS

Purposes and advantages of the exemplary embodiments will be apparent tothose of ordinary skill in the art from the following detaileddescription in conjunction with the appended drawings in which likereference characters are used to indicate like elements, and in which:

FIG. 1 is a high level schematic of a system that may providemonitoring, analyzing, and troubleshooting of one or more networkelements in accordance with an exemplary embodiment;

FIG. 2 is a detailed schematic of a system that may provide monitoring,analyzing, and troubleshooting of one or more network elements inaccordance with an exemplary embodiment;

FIG. 3 is another detailed schematic of a system that may providemonitoring, analyzing, and troubleshooting of one or more networkelements in accordance with an exemplary embodiment; and

FIG. 4 is a flow diagram of a method for monitoring, analyzing, andtroubleshooting of one or more network elements in accordance with anexemplary embodiment.

These and other embodiments and advantages will become apparent from thefollowing detailed description, taken in conjunction with theaccompanying drawings, illustrating by way of example the principles ofthe various exemplary embodiments.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

A system and method in accordance with exemplary embodiments of thepresent disclosure may include collecting backbone router data and/orother network element data, storing the data, and analyzing the data.For example, the backbone routers may be routers located in the backbonearea of the network while other areas of the network are connected toit. The backbone routers may perform inter-area routing of the networkelement data. The data may be automatically displayed to a user via auser interface. Also, the data may be displayed to a user via the userinterface in response to commands received via the user interface. Thedisplayed data may assist the user in real-time troubleshooting and/orpost-event forensic analysis. Moreover, reports may be generated forvarious reasons to inform a user of conditions in one or more networkelements. Furthermore, an alert may be generated to provide warning ofabnormal activity and/or instability in the one or more networkelements.

The description below describes servers, computers, terminals, clientdevices, and other computing devices that may include one or moremodules, some of which are explicitly depicted, others of which are not.As used herein, the term “module” may be understood to refer toexecutable software, firmware, hardware, and/or various combinationsthereof. It is noted that the modules are exemplary. The modules may becombined, integrated, separated, and/or duplicated to support variousapplications. Also, a function described herein as being performed at aparticular module may be performed at one or more other modules and/orby one or more other devices instead of or in addition to the functionperformed at the particular module. Further, the modules may beimplemented across multiple devices and/or other components local orremote to one another. Additionally, the modules may be moved from onedevice and added to another device, and/or may be included in bothdevices. It is further noted that the software described herein may betangibly embodied in one or more physical media, such as, but notlimited to, a compact disc (CD), a digital versatile disc (DVD), afloppy disk, a hard drive, read only memory (ROM), random access memory(RAM), as well as other physical media capable of storing software,and/or combinations thereof. Moreover, the figures illustrate variouscomponents (e.g., servers, computers, etc.) separately. The functionsdescribed as being performed at various components may be performed atother components, and the various components may be combined and/orseparated. Other modifications also may be made.

FIG. 1 illustrates an exemplary system 100 for monitoring, analyzing,and troubleshooting of one or more network elements in accordance withan exemplary embodiment. The system 100 may monitor one or more networkelements located in a control plane (e.g., a portion of the routerarchitecture that may be associated with configuring a network mapand/or information in a routing table) of the network. Also, the system100 may monitor the control dynamics of the one or more network elementsbased at least in part on one or more protocols. Protocols that may bemonitored may include, but are not limited to, internal Border GatewayProtocol (iBGP), Label Distribution Protocol (LDP), Protocol IndependentMulticast (PIM), and Open Shortest Path First (OSPF). It is noted thatother protocols may be monitored in similar manners.

As illustrated in FIG. 1, system 100 may include one or more userdevices 102 which may interact with one or more network elements 110within a network 108 via a monitoring module 104 and/or an internal datanetwork 106. A user may be associated with, but is not limited to,service providers, enterprises, educational institutions, governmentagencies, and any individual, group and/or organization running,maintaining and/or monitoring a network. Users within an organizationmay include, but are not limited to, network architects, networkmanagers, engineers, planners, Network Operations Center (NOC)personnel, marketing, sales engineering, operations personnel, andcustomer support organizations.

The one or more user devices 102 may be a computer, a personal computer,a laptop, a cellular communication device, a global positioning system(UPS), a workstation, a mobile device, a phone, a handheld PC, apersonal digital assistant (PDA), a thin system, a fat system, a networkappliance, an Internet browser, a paging, an alert device, a television,an interactive television, a receiver, a tuner, a high definition (HD)television, a HD receiver, a video-on-demand (VOD) system, and/or otherany other device that may allow a user to communicate with themonitoring module 104 via one or more networks (not shown) as known inthe art.

A user associated with the one or more user devices 102 mayinteractively browse and/or monitor the one or more network elements 110to display various information associated with one or more networkelements 110 within the network 108 via the one or more user devices102. The user may monitor one or more interfaces associated with the oneor more network elements 110. Also, the user may monitor a correlationbetween various parameters to highlight the interactions that may occurbetween the one or more network elements 110 within the network 108,e.g., an Internet Protocol (IP) network, etc. For example, the user maymonitor routing protocols, interactions between the network elements 110and internal Border Gateway Protocol (iBGP), Label Distribution Protocol(LDP), Protocol Independent Multicast (PIM), and Open Shortest PathFirst (OSPF). Also, the user may monitor interior routing dynamics,e.g., views of individual sub-autonomous-systems and/or individualnetwork element within the network 114. Further, the user may monitorany hidden routing dynamics, complex detailed routing protocols and/orlow-level routing protocols associated with the one or more networkelements 110.

A monitoring module 104 may be one or more servers. The monitoringmodule 104 may include a UNIX based servers, Windows 2000 Server,Microsoft IIS server, Apache HTTP server, API server, Java sever, JavaServlet API server, ASP server, PHP server, HIP server, Mac OS X server,Oracle server, IP server, and/or other independent server to monitor oneor more network elements 110.

The internal data network 106 may be coupled to the network 108 via amanagement Ethernet port (not shown). The internal data network 106and/or the network 108 may be a wireless network, a wired network or anycombination of wireless network and wired network. For example, theinternal data network 106 and/or the network 108 may include, withoutlimitation, Internet network, satellite network (e.g., operating in BandC, Band Ku and/or Band Ka), wireless LAN, Global System for MobileCommunication (GSM), Personal Communication Service (PCS), Personal AreaNetwork (PAN), D-AMPS, Wi-Fi, Fixed Wireless Data, satellite network,WEE 802.11a, 802.11b, 802.15.1, 802.11n and 802.11g and/or any otherwireless network for transmitting a signal. In addition, the internaldata network 106 and/or the network 108 may include, without limitation,telephone line, fiber optics, IEEE Ethernet 802.3, wide area network(WAN), local area network (LAN), global network such as the Internet.Also, the internal data network 106 and/or the network 108 may enable,an Internet network, a wireless communication network, a cellularnetwork, an Intranet, or the like, or any combination thereof. Theinternal data network 106 and/or the network 108 may further includeone, or any number of the exemplary types of networks mentioned aboveoperating as a stand-alone network or in cooperation with each other.

Network 108 may include one or more network elements 110. The one ormore network elements 110 may be a router, switches, relays, circuitboards and/or other telecommunication equipment that may provide supportor services to a user.

FIG. 2 illustrates a detailed exemplary system 100 for monitoring,analyzing, and troubleshooting of one or more network elements inaccordance with an exemplary embodiment. As shown in FIG. 2, themonitoring module 104 may include a collector module 208 which maycollect data from the one or more network elements 110 in the network108 via the internal data network 106. The collector module 208 maypreprocess the data collected from the one or more network elements 110in the network 108, e.g., filter, format, aggregate, etc. Thepreprocessing of the data provided by the collector module 208 mayinclude filtering data and eliminate undesired data, formatting datainto useful format, and/or data aggregation where data is gathered andexpressed in a summary form. The data may be transferred from thecollector module 208 to a repository module 210. The repository module210 may store and/or manage the data transferred from the collectormodule 208. An analytic module 212 may access the repository module 210to obtain the data needed to perform one or more analyses, e.g.,predetermined analysis. Finally, the data and/or result of the one ormore analyses may be transferred to a presentation module 206 andpresented to a user via the one or more user devices 102 at apredetermined period of time. Also, the data and/or the result of theone or more analyses may be automatically and/or upon a request by auser, transferred to a presentation module 206 and presented to a uservia one or more user devices 102. A presentation module 206 may providean interface between one or more user devices 102 and the monitoringmodule 104. The presentation module 206 may include a user interface,e.g., a graphical user interface, to receive requests from the user andto provide information and/or data to the user via the one or more userdevices 102. The presentation module 206 may provide a separate and/or aunified graphical user interface where the presentation module 206 mayprovide a user with a separate and/or a unified view of one or moreprotocols e.g., separate and/or unified view of internal Border GatewayProtocol (iBGP), Label Distribution Protocol (LDP), Protocol IndependentMulticast (PIM), and Open Shortest Path First (OSPF). Also, a user maymonitor various interfaces associated with the one or more networkelements 110 without manually accessing each interface associated withthe one or more network elements 110. Thus, a user may monitor variousprotocols and/or interfaces associated with the one or more networkelements 110 without manually converting various protocols separatelyand/or into a unified form.

In addition, the presentation module 206 may include an ApplicationProgramming Interface (API) to interact with the one or more userdevices 102. In response to receiving a request from a user via the oneor more user devices 102, the presentation module 206 may send requests(or control signals, etc.) to the collector module 208, the repositorymodule 210, and the analytical module 212. In response to a request, theanalytical module 212 may (a) receive data from repository module 20and/or collector module 208, (b) analyze the data, and (c) provide dataand/or analysis result to the presentation module 206. The presentationmodule 206 may provide the data and/or analysis results to one or moreuser devices 102 for display. As a result, system 100 may allow a userto monitor the network 108 in real-time and/or near real-time.

Moreover, the presentation module 206 may include a report generatormodule (not shown) for generating reports. A report may be automaticallygenerated in the event of a catastrophic network overload, networkoutage, router failure, network instability and/or a scheduled event.For example, a user may schedule the monitoring system 104 to generate areport of the one or more network elements 110 during a networkmaintenance and/or a network upgrade. Also, a report may be generatedperiodically, e.g., hourly, daily, weekly, monthly, yearly, etc, and mayinclude date, time, various parameters and/or analysis in accordance toa user's request. Further, a report may be generated automatically whena user is logged into system 100 in order to update the user ofoperation and/or instability within the network 108 since the last timethe user was logged into system 100. For example, an outage in the oneor more network elements 110 in the network 108 may occur during theprevious day, a report may be generated automatically and/or upon arequest by a user which may include, date, time, data and/or analysisassociated with the outage in the one or more network elements 110 inthe network 108. Thus, a user may be informed of concerns, problems,and/or repairs that may be needed for the one or more network elements110 in the network 108.

Furthermore, the presentation module 206 may include an alert dispatchermodule (not shown) for alerting one or more users in response touser-specified conditions. For example, a user may define a set of rulesand/or conditions upon the occurrence of such rules and/or conditions, areport may be generated to alert the one or more users. Such a reportmay include date, time, one or more set of rules and/or conditionsdefined by a user, an analysis of data collected from the one or morenetwork elements 110 in the network 108, and/or status of variousnetwork elements 110. A user may be alerted in cases of instability inthe operation of a network, failure of network element, network outage,achieving a predetermined threshold or value, one or morethreshold-crossing events, data corruption, error in transferring dataand/or other parameters requested by the user. For example, a user maymonitor a variety of protocols which may include, but not limited to,internal Border Gateway Protocol (iBGP), Label Distribution Protocol(LDP), Protocol Independent Multicast (PIM), and Open Shortest PathFirst (OSPF) and/or other protocols associated with the one or morenetwork elements 110 in the network 108. Also, a user may monitorvarious interfaces which may include, but not limited to, outboundinterfaces, local interfaces, logical interfaces, inbound interfaces,service interfaces, client interfaces and/or other interfaces associatedwith the one or more network elements 110 in the network 108. Thedispatched alert can take various forms including, but not limited to,email, telephone call, paging alert.

The collector module 208 may interact with the one or more networkelements 110 in the network 108. Through these interactions, thedynamics of the one or more interfaces associated with the one or morenetwork elements 110 may be captured. For example, the collector module208 may sequentially and/or simultaneously collect data from the one ormore network elements 110. The collector module 208 may use one or moremethods to access the one or more network elements 110 via the internaldata network 106. For example, the collector modules 208 may access theone or more network elements 110 via telecommunication network (TELNET),command line interface (CLI), secure socket header (SSH), simple networkmanagement protocol (SNMP), File Transfer Protocol (FTP), Secure Shell(SSH), and/or other methods access and/or collecting data from the oneor more network elements 110. The collector module 208 may provide thedata from each of the one or more network elements 110 to the repositorymodule 210. This data may include, but is not limited to, an up/downstate associated with the one or more network elements 110, protocols,interfaces, routing table size, route updates, and event logs. Thecollector module 208 may preprocess the data collected from the one ormore network elements 110 before transferring the data to the repositorymodule 210.

The repository module 210 may store and manage data from the collectormodule 208. The repository module 210 may provide an interface, e.g., auniform interface, for other modules within the system 100 and maywrite, read, and search data in one or more repositories or databases.The repository module 210 may also perform other functions, such as, butnot limited to, concurrent access, backup and archive functions. Also,due to limited amount of storing space the repository module 210 maycompress, store, transfer and/or discard the data stored within after aperiod of time, e.g., a month. The repository module 210 may providedata to the analytical module 212.

The analytical module 212 may retrieve data from the repository module210 and analyze such data. The analytical module 212 may further includea plurality of sub-analytical modules to perform various types of dataanalysis. The analytical module 212 may perform various analyses, suchas, but not limited to, time series analysis, forensic analysis, and/orpattern matching analysis. For example, using the one or more userdevices 102, a user may select various types of data analyses to beperformed. A user may select a time series data analysis where datacollected at an earlier time may be compared with the current data,Also, a user may select forensic data analysis where a user may selectto analyze the data collected in the past. Further, a user may selectpattern matching analysis where patterns associated with the datacollected in the past may be matched with the current data. The analyticmodule 212 may summarize and aggregate data retrieved from therepository module 210 to provide a complete report of the routingdynamics protocol and/or one or more interfaces from the one or moreinterfaces associated with the one or more network elements 110.

Referring to FIG. 3, a detailed schematic of a system that may providemonitoring, analyzing, and troubleshooting of one or more networkelements in accordance with an exemplary embodiment is illustrated. FIG.3 is a more detailed view of monitoring module 104 compared to FIGS. 1and 2. As shown, the presentation module 206 may include a web interface320, a web server 322, and a database 326.

The web interface 320 may include software code for interfacing with oneor more user devices 102. For example, the software code may be sourcecode written in HTML (HyperText Markup Language) and/or PHP (HypertextPreprocessor). The software code may drive the web server 322 to provideand receive information to and from the user via one or more userdevices 102. The web interface 320 may access data, such as systemconfiguration and user authentication data from the database 326 via theweb server 322. The web interface 320 may access routing data from therepository module 210 via the web server 322. The web interface 320 mayalso be part of the analytical module 212 and perform analysis of thedata in the repository module 210. The web server 322 may be aPHP-enabled Apache server. The web server 322 may interact with one ormore user devices 102 via one or more networks as known in the art.

The repository module 210 may route the data files between the gatewayinterface 332 of the collector module 108 and the web server 322 of thepresentation module 206. Software code may be associated with thegateway interface 332 which may include, but not limited to, Perl andExpect scripts, for retrieving data and processing data. The softwarecode associated with the gateway interface 332 may access the one ormore network elements 110 via the internal data network 106 to retrieveone or more interfaces/protocols data and may store the data asinterfaces/protocols data files which are provided to the repositorymodule 210. Also, the software code associated with the gatewayinterface 332 may be configured to filter, format, and aggregate thedata prior to storing the interface/protocol data files. For example,using Expect scripts, the gateway interface 332 can retrieveinterface/protocol data through interactive applications such astelecommunication network (TELNET), command line interface (CLI), securesocket header (SSH), simple network management protocol (SNMP), FileTransfer Protocol (FTP), Secure Shell (SSH), etc. A scheduling service330 may trigger the gateway interface 332 to obtain interface/protocoldata from the one or more network elements 110, e.g., routers, atspecific times, e.g., hourly or daily. The scheduling service 330 and/orthe gateway interface 332 may form the collector module 208.

FIG. 4 illustrates a flow diagram of a method for monitoring, analysis,and troubleshooting of one or more network elements in accordance withexemplary embodiments. This exemplary method 400 is provided by way ofexample, as there are a variety of ways to carry out methods accordingto the present disclosure. The method 400 shown in FIG. 4 can beexecuted or otherwise performed by one or a combination of varioussystems. The method 400 described below may be carried out by system 100shown in FIGS. 1, 2 and 3 by way of example, and various elements of thesystem 100 are referenced in explaining the example method of FIG. 4.Each block shown in FIG. 4 represents one or more processes, methods orsubroutines carried in exemplary method 400. Referring to FIG. 4,exemplary method 400 may begin at block 402.

At block 402, a collector module 208 may collect first data associatedwith one or more network elements 110. The collector module 208 mayaccess the one or more network elements 110 by transmitting one or moreaccess request signals over an internal data network 106. The collectormodule 208 may use various methods to access the one or more networkelements 110. For example, various access methods may includetelecommunication network (TELNET), command line interface (CLI), securesocket header (SNMP), simple network management protocol (SNMP), FileTransfer Protocol (FTP), Secure Shell (SSH), etc. The collector module208 may collect data associated with one or more protocols associatedwith the one or more network elements 110. For example, the one or moreprotocols may include, but are not limited to, internal Border GatewayProtocol (iBGP), Label Distribution Protocol (LDP), Protocol IndependentMulticast (PIM), and Open Shortest Path First (OSPF). Also, thecollector module 208 may collect data associated with one or moreinterfaces associated with the one or more network elements 110. Forexample, the one or more interface may be a connection between a serviceprovider and one or more clients. Thereafter, the collector module 208may transfer the collected data associated with the one or more networkelements 110 to a repository module 210. The repository module 110 mayalso perform other functions, such as, but not limited to, concurrentaccess, backup and archive functions. After the collector module 208 maycollect data associated with one or more network elements 110, themethod 400 may proceed to block 404.

At block 404, the collector module 208 may collect second data from theone or more network elements 110 at a predetermined time interval, e.g.,every second, every minute, every hour, etc. The first and/or seconddata collected from the one or more network elements 110 by thecollector module 208 may be an up state or a down state associated withthe one or more network elements 110. For example, the up state mayrepresent the one or more network elements 110 are functioning properlywherein one or more protocols and/or one or more interfaces associatedwith the one or more network elements 110 are functioning properly. Thedown state may represent a failure of the one or more network elements110 wherein the one or more protocols and/or the one or more interfacesassociated with the one or more network elements 110 are not functioningproperly. The second data collected at the predetermined interval by thecollector module 208 may transfer to a repository module 210 to beprocessed include filtering, formatting and/or aggregating. After thecollector module 208 may collect second data associated with one or morenetwork elements 110 at the predetermined interval, the method 400 mayproceed to block 406.

At block 406, an analytical module 212 may analyze the data collected bythe collector module 208. The analytical module 212 may retrieve firstand/or second data from the repository module 210. For example, theanalytical module 212 may retrieve the first data and the second datacollected by the collector module 208 from the repository module 210 attwo disparate time intervals. The analytical module 212 may compareand/or contrast the first data and the second data. For example, apredetermined number of neighboring open shortest path first (OSPF) maybe associated with the one or more network elements 110. Also, atransmission control protocol (TCP) may run between each predeterminednumber of neighboring open shortest path first (OSPF). The analyticalmodule 212 may detect a down state associated with the one or more ofthe predetermined number of neighboring open shortest path first (OSPF)from about real-time (e.g., as rapidly as required, actual time) thesecond data collected by the collector module 208. Thereafter, theanalytical module 212 may compare and/or contrast about real-time (e.g.,as rapidly as required, actual time) the second data with the first datacollected by the collector module 208. For example, the analyticalmodule 212 may determine that the one or more neighboring open shortestpath first (OSPF) in the down state in the second data may not be in thedown state in the first data. Therefore, the analytical module 212 maysend an alert/report to the one or more user devices 102 via apresentation module 206. Also, the analytical module 212 may compareand/or contrast about real-time (e.g., as rapidly as required, actualtime) the first and/or the second data with a predetermined thresholdvalue. For example, a user may set the predetermine threshold valuebased at least in part on network specifications and/or networkconfigurations. The analytical module 212 may determine that one or moreof the predetermined number of neighboring open shortest path first(OSPF) may not match the predetermined threshold value. Therefore, theanalytical module 212 may send alert/report to the one or more userdevices 102 via the presentation module 206. After the analytical module212 may analyze the data collected by the collector module 208, themethod 400 may proceed to block 408.

At block 408, the analysis results are provided to the user. Forexample, web server 322 provides the analysis results to the one or moreuser devices 102. Also, the web server 322 may provide the analysisresults to the one or more user devices 102 associated with the user whorequested the analysis. The web server 122 may cause one or more userdevices 102 to display the results of the analysis to the user.

In the preceding specification, various preferred embodiments have beendescribed with reference to the accompanying drawings. It will, however,be evident that various modifications and changes may be made thereto,and additional embodiments may be implemented, without departing fromthe broader scope of the disclosure as set forth in the claims thatfollow. The specification and drawings are accordingly to be regarded inan illustrative rather than restrictive sense.

1. A computer implemented system comprising: a collector moduleconfigured to collect state data of one or more protocols associatedwith one or more routers of a network at discrete time intervals; ananalytical module comprising at least one programmable processorconfigured to analyze corresponding state data collected at two or morediscrete time intervals by comparing the state data collected at the twoor more discrete time intervals; and a presentation module configured togenerate a report of a result of the analysis of the state data to oneor more user devices.
 2. The computer implemented system of claim 1,wherein the one or more routers associated with the network are one ormore backbone routers.
 3. The computer implemented system of claim 1,wherein the collector module is further configured to access the one ormore routers via at least of a telecommunication network, secure socketheader (SSH) and simple network management protocol (SNMP).
 4. Thecomputer implemented system of claim 1, wherein the one or moreprotocols associated with the one or more routers comprises at least oneof internal Border Gateway Protocol (iBGP), Label Distribution Protocol(LDP), Protocol Independent Multicast (PIM), and Open Shortest PathFirst (OSPF) protocol.
 5. The computer implemented system of claim 1,wherein the collector module is further configured to perform at leastone of filter, format and aggregate the state data.
 6. The computerimplemented system of claim 1, wherein the analytical module is furtherconfigured to perform at least one of pattern matching analysis, timeseries analysis and forensic analysis based at least in part on thecorresponding state data collected at the two or more discrete timeintervals.
 7. The computer implemented system of claim 1, wherein thepresentation module is further configured to alert a user based at leastin part on one or more parameters specified by the user.
 8. The computerimplemented system of claim 1, wherein in response to the analyticalmodule determining that at least one of the one or more protocols andone or more interfaces associated with the one or more routers are in adown state, the presentation module is configured to alert a user. 9.The computer implemented system of claim 1, wherein the presentationmodule is further configured to generate a report based at least in parton the analysis of the state data collected at two or more discrete timeintervals.
 10. The computer implemented system of claim 1, wherein thepresentation module is further configured to provide at least one of aseparate view and an unified view of the one or more protocolsassociated with the one or more routers.
 11. The computer implementedsystem of claim 1, wherein the one or more routers further comprise atleast one of outbound interfaces, local interfaces, logical interfaces,inbound interfaces, service interfaces, and client interfaces.
 12. Thecomputer implemented system of claim 1, wherein the one or more userdevices are configured to display the report of the result of theanalysis.
 13. A method, comprising: collecting state data of one or moreprotocols associated with one or more routers of a network at discretetime intervals; analyzing corresponding state data collected at two ormore discrete time intervals, wherein analyzing corresponding state datacollected at two or more discrete time intervals comprises comparing thestate data collected at the two or more discrete time intervals; andoutputting a report of a result of the analysis of the state data to oneor more user devices.
 14. The method of claim 13, further comprisesalerting a user based at least in part on a determination that at leastone of the one or more protocols and one or more interfaces associatedwith the one or more routers are in a down state.
 15. The method ofclaim 13, wherein the one or more routers associated with the network islocated in a control plane of the network.
 16. The method of claim 13,further comprises performing at least one of filtering, formatting andaggregating the state data of the one or more protocols collected fromthe one or more routers associated with the network.
 17. The method ofclaim 13, wherein analyzing the state data of the one or more protocolscollected from the one or more routers associated with the networkfurther comprises performing at least one of pattern matching analysis,time series analysis, and forensic analysis based at least in part onthe state data of the one or more protocols associated with the one ormore routers at the two or more discrete time intervals.
 18. The methodof claim 13, further comprises alerting a user based at least in part onone or more parameters specified by the user.
 19. The method of claim13, further comprises generating a report based at least in part on oneor more parameters specified by a user.
 20. The method of claim 13,further comprises providing at least one of a separate view and anunified view of the one or more protocols associated with the one ormore routers.
 21. A non-transitory computer readable media comprisingcode to perform the acts of the method of claim 13.